Windows 10 / duplicate "nobody" PID's

[Stan Garvin]

Hello all,

Default smb/windows share on FreeNAS-11.0-U2 with user setup local to FreeNAS. Seems to be working ok other than there are dozens of "nobody" users and "nobody" group PID's that never seem to terminate unless the Windows 10 clients turn off their workstations.

All clients are Windows 10 with the max protocol set to SMB3 - per default. The one adjustment I made that didn't seem to effect anything was "map to guest = Never."

I know in the past, setting max protocol set to NT1 alleviated some of this, but I would like to avoid that for obvious reasons - clients are authenticating and working, but these "nobody" PID's will get out of control.

 

[Artion]

Hi, could you please post a screenshot?

Inviato dal mio YD201 utilizzando Tapatalk

 

[Stan Garvin]

Hi, could you please post a screenshot?

Inviato dal mio YD201 utilizzando Tapatalk

 

[Artion]

Are the share permissions set to allow guest connections? Could you also post a screenshot of the permissions on datasets and/or of the shares?

Inviato dal mio YD201 utilizzando Tapatalk

 

[Stan Garvin]

Are the share permissions set to allow guest connections? Could you also post a screenshot of the permissions on datasets and/or of the shares?

Inviato dal mio YD201 utilizzando Tapatalk

As noted..."map to guest = Never"

Permissions are 775 as per default smb/Windows share - no guest at all.

 

[Stan Garvin]

Woke up this morning to check on server.

smbstatus | grep nobody | wc -l

91 duplicate "nobody" PID's from the same client workstation. Did a "kill PID" to retire the used sockets, but that is not sustainable - the server will run out of resources.

I'm reluctant to switch protocol to SMB1 (NT1), as it will soon be deprecated by Windows 10, is slower and is exploitable.

Any suggestions?

 

[Artion]

It's a very strange situation. I tried to replicate it but just one nobody connection per workstation, browsing as guest. Could it be a problem with your workstations?! I used a test win10 pro machine with fresh install and limited samba on FN from a minor version of 3 to major 3.11. I'm also on FreeNAS-11.0-U2 (e417d8aa5).

 

[Stan Garvin]

Artion,

Thanks for responding...I'm beginning to think similarly.

I've got guest access completely disabled on all shares, in addition, "map to guest = Never" set as well.

I think this particular guest client (Windows 10) is infected.

When I can confirm the issue, I'll report back for everyone's benefit.

Hardware is iXsystems FreeNAS Mini
Software is FreeNAS-11.0-U2